Most phishing is caught in about twenty seconds by checking three things: who actually sent the message, where the link actually goes, and whether it is trying to rush you. Everything else in this guide is detail on those three. If any one of them fails, stop and verify through a channel you chose yourself.
The 20-second checklist
1. Read the real sender domain, not the display name
The name shown in your inbox is free text that anyone can set. Expand the header and look at what comes after the @. Attackers register look-alike domains such as paypa1.com, micros0ft-support.com or a legitimate brand as a subdomain of their own domain, as in bank.secure-login.example.net. The part that matters is the last two labels immediately before the first slash. Homoglyphs make this harder, because some characters from other alphabets look nearly identical to Latin ones. If a domain looks right but you are unsure, run it through an email validator: a sender address at a domain with no mail records at all is a strong signal that something is wrong.
2. Hover the link and read the host
Do not click. Hover, or long-press on mobile, and read the real destination in the status bar. Ignore the visible text, which can say anything, and read left to right until the first slash. Shortened links hide the destination completely, so treat one in a message about money or credentials as a red flag on its own.
3. Notice the pressure
Phishing runs on urgency: your account will be closed today, a payment failed, a parcel is held, a fine is due, someone signed in from another country. Real companies do send alerts, but they rarely give you two hours and they never mind you logging in yourself instead of using their link.
4. Treat unexpected attachments as hostile
An invoice you did not order, a CV you did not ask for, a scanned document from a company you do not use. Archives, disk images and anything asking you to enable macros are all common carriers. If you did not expect a file, do not open it to find out what it is.
5. Nobody legitimate asks for a code or password
No bank, provider or support team will ever ask for your password, your recovery codes, or the one-time code that just arrived. Anyone asking for an OTP is trying to complete a login they have already started with your stolen password. Read the code's own message: it usually says what it is authorising.
6. Generic greetings and odd details
"Dear Customer", a service you do not use, a currency or address that does not match yours, a reply-to that differs from the sender. None of these prove anything alone, but two together are enough to slow down.
The hard cases
Modern phishing is often well written and visually perfect, so the old advice about spelling mistakes no longer carries much weight. Three patterns are worth knowing:
- Real-looking invoices. Business email compromise copies a genuine thread and changes only the bank details, sometimes from a mailbox that has actually been taken over. Confirm any change of payment details by phone, on a number you already had.
- MFA fatigue. A stream of push approval prompts at 3am is an attacker with your password hoping you tap accept to make it stop. Deny them all and change the password immediately.
- QR-code phishing. A code in an image or a PDF bypasses link scanning and moves you to a phone, where the address bar is short and easy to misread. Type the address yourself instead.
If you already clicked
- Entered a password? Change it on the real site now, and everywhere you reused it.
- Approved a code or a push? Sign out all sessions, then reset 2FA enrolment.
- Opened a file? Disconnect from the network and run a full scan.
- Sent money or card details? Call the bank straight away and ask about a recall.
- Report it to your provider or IT team, even if nothing happened. It protects everyone else.
Make phishing harder to pull off
Checklists help, but structure helps more. If you own a domain, publish SPF, DKIM and a DMARC policy so that mail forged in your name is rejected rather than delivered; SPF, DKIM and DMARC explained covers what each record does. Turn on two-factor authentication everywhere, and keep the codes in an authenticator such as this TOTP generator rather than SMS. Passkeys go further still, because they simply cannot be phished onto a look-alike domain.
Reduce your exposure too. Use a disposable address for downloads, trials and forums, so that when one of them leaks its database, the flood of targeted phishing never reaches the address your bank uses. And when a message arrives from an unfamiliar sender, checking whether the address even exists takes a moment with the email validator; if you want the longer version, see how to check if an email address is real.
FAQ
Is opening a phishing email dangerous?
Opening the message itself is usually harmless on a modern, updated client. The danger is in what you do next: clicking, opening an attachment, or typing credentials. Keep remote images off and nothing loads automatically.
The sender address looks exactly right. Can it still be fake?
Yes. Sender addresses can be forged unless the receiving server checks SPF, DKIM and DMARC and the sending domain publishes them. That is why the link destination and the request itself matter more than the address alone.
Should I reply to ask whether it is genuine?
No. A reply confirms the address is live and reaches the attacker, not the company. Contact the organisation on a number or address you already had, or by typing their site into the browser yourself.
What if it names my real details?
Names, phone numbers and past orders leak in breaches constantly, so knowing them proves nothing. Judge the message on the sender domain, the link and the request, not on how much it appears to know about you.
